Practice infrastructure compliance vocabulary: Terraform plan violations, non-compliant resources, tagging policies, auto-remediation, drift detection, and compliance reporting.
0 / 10 completed
1 / 10
'The Terraform plan shows a ___ violation.' Which noun describes a policy breach in IaC?
A 'compliance violation' in a Terraform plan means the planned infrastructure changes would create or modify a resource that doesn't meet defined policy standards (e.g., missing required tags, open security groups).
2 / 10
'The resource is non-___ with the tagging policy.' Which adjective fits?
'Non-compliant' is the standard adjective for a resource that doesn't meet policy requirements. 'Non-compliant with the tagging policy' means required tags are missing or incorrect.
3 / 10
'Auto-___ runs when drift is detected.' Which noun describes automatically fixing policy violations?
'Auto-remediation' automatically corrects non-compliant or drifted resources — e.g., adding missing tags, reverting unauthorized security group changes, or enforcing encryption settings.
4 / 10
What is 'drift' in infrastructure compliance?
Infrastructure 'drift' occurs when someone manually changes a resource outside of IaC (Terraform/Pulumi), creating a gap between the declared desired state and the actual running state.
5 / 10
'The compliance report shows 94% policy ___.' Which noun measures how many resources follow the policy?
'Policy adherence' (or compliance rate) measures the percentage of resources that meet all defined policies. 94% means 6% of resources are non-compliant and need remediation.
6 / 10
Reviewer: 'I'm seeing a potential issue with the EC2 instance. It's marked as `non-compliant` due to missing security group rules. Can you confirm this is intentional or needs remediation?', Sarah (Developer): 'No, that's correct. We haven't configured the SG yet.'
The term 'exception' accurately describes the situation here. An exception is a specific instance where a rule isn't followed, but it doesn't necessarily mean there's a systemic issue or risk. 'Violation' is too strong – it implies a broader breach. 'Risk' and 'anomaly' are less precise descriptions of what Sarah observed.
7 / 10
'@john.doe: Hey, the latest deployment to staging shows a high number of resources without labels. This is impacting our ability to track costs and enforce policy compliance. Can you investigate?', Maria (DevOps): 'I'm looking into it now.'
'Tagging' is the correct answer because Maria's message explicitly refers to 'resources without labels.' Labels are metadata used in tagging. The other options represent broader concepts or activities related to IT management and compliance, but they aren't the direct cause of the problem described.
8 / 10
PR Description: 'Updated application server configuration. Added new logging to improve debugging capabilities.'
'Compliance' is the appropriate choice because any configuration change needs to be assessed for its impact on existing policies. While 'impact' and 'risk' are related, compliance is the core requirement being addressed by this PR. The other options describe different goals of system changes.
9 / 10
'Mark (Developer): 'I'm working on implementing infrastructure-as-code for our new database cluster. I've been focusing on ensuring it meets the latest security compliance requirements through Terraform configurations.'
'Scalability' is the most relevant term here. Mark explicitly mentions ensuring compliance through Terraform configurations – this directly relates to the ability of the database cluster to handle increased workloads while maintaining policy adherence. 'Drift' describes changes that *cause* a deviation from the intended state; scalability addresses how the system *responds* to changes.
10 / 10
API Response: `{"status": "error", "code": 403, "message": "Access denied due to policy violation. Resource 'db-prod-instance' lacks a required security group rule."}`
'Authorization' represents the correct answer. The API response explicitly states 'Access denied due to policy violation,' indicating that the system is enforcing rules about which resources a user can access. Authentication confirms *who* is trying to access something; authorization determines *what* they are allowed to do. Monitoring and logging are related, but not the direct cause of the denial.
What will I practice in "Infrastructure Compliance Vocabulary"?
This is a Policy As Code exercise set. It walks through 10 scenario-based multiple-choice questions built around real usage of policy as code terminology that IT professionals encounter on the job.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to complete with no account, sign-up, or paywall.
How many questions are in this exercise?
This set contains 10 questions. Each one shows immediate feedback and a detailed explanation after you answer, so you learn the correct usage right away rather than waiting for a final score.
Do I need prior experience to complete this exercise?
No prior experience is required. Each question includes a full explanation covering the reasoning behind the correct answer, so the exercise itself teaches the policy as code vocabulary as you go.
Can I retry the exercise if I get questions wrong?
Yes — use the "Try again" button on the results screen to reset your answers and go through all the questions again. There is no limit on attempts.
Is my progress saved?
Your answers and score for the current session are tracked in the browser as you go. No account or login is needed, and there is nothing to install.
What if I don't understand a term used in a question?
Read the explanation shown after you answer each question — it breaks down the correct term in plain English with a real-world example. You can also check the site Glossary for quick definitions.
How is this different from reading a blog article on the topic?
Exercises like this one are interactive drills that test and reinforce specific vocabulary through multiple-choice questions, while blog articles explain concepts in prose. Practising here after reading builds active recall, not just passive recognition.
Where can I find more Policy As Code exercises?
See the Policy As Code exercises hub for the full set of related pages, or browse all exercise categories from the main Exercises index.
Can I use this exercise to prepare for a technical interview?
Yes — policy as code vocabulary comes up often in technical discussions and interviews. Pair this exercise with our dedicated Interview Preparation section for role-specific practice.